MBAM 2.0 Service CPU Usage

[Velvetcoat]

Why does the mbamservice.exe need to take 40%+ of CPU cycles?

 

Having just installed MBAM v2.0.0.1000, I noticed that my laptop was running like it was in treacle. Using Process Explorer, I found that mbamservice.exe was taking as much processor time as system idle and not just for a short period, MOST of the time. My i7 processor was showing that it was running at full boost, 3.06GHz also most of the time.

 

Why the extreme CPU usage? Surely it shouldn't need this much processing time!

 

1.75.0.1300 worked OK, v2.0.0.1000 seems to be a beta that needs more work urgently.

 

 

My system:

 

Alienware M15x, i7 620M CPU, 8Gb RAM, Radeon HD 6570

[Velvetcoat]

I have uninstalled v2.0.0.1000 and re-installed v1.75.0.1300 and, using Process Explorer, checked the CPU usage of mbamservice.exe. Instead of 40%+ it is now averaging 0.2%! Checking the performance graph, CPU usage doesn't even show on the display, it's too low to register.

 

This does suggest problems with v2.0.0.1000's mbamservice.exe

[John L. Galt]

Yeah, I've been running MBAM 2.0 since the betas, and I just checked - mine is using 0.55%.

 

When installing, did you allow it to up date and run a scan?  Has that scan completed?  have you rebooted your computer since then?

 

[Velvetcoat]

Hi,

 

I updated MBAM, allowed it to update and run a scan to completion (in fact I ran two - the initial one and a hyper scan. Both ran to completion). I immediately noticed that my laptop seemed slow but didn't think anything more until this morning when I started it up. The laptop gave the impression of running in treacle, so I opened Process Explorer to check what was taking CPU cycles and found that mbamservice.exe was taking over 40%, not just short term but continuously. I posted onto the forum, then removed v2 and re-installed v1.75 and checked using Process Explorer and this time mbamservice.exe showed 0.2%.

 

From this result, I would, as I stated above, suspect mbamservice.exe of having some kind of CPU usage problem.

[AdvancedSetup]

Please try the following clean removal process and reinstall version 2 and let us know how its working now.

 

MBAM Clean Removal Process
 

Thank you

[Velvetcoat]

I followed the procedures above and noticed that the version has changed to 2.0.0.1004!

 

After installation I clicked the anti-rootkit box in 'Detection & Protection' then ran the update and allowed MBAM to scan the laptop. The scan completed OK but an error box came up saying that 'MBAM was unable to load the Ant-Rootkit Driver Error Code: 20026 Do you want to continue the scan without ant-rootkit support?' I then ran a Hyper scan and received two differing messages when it completed - 1. it found an error; 2. clicking on the error, it vanished and said no errors found; 3. the anti-rootkit driver error again.

 

I have attached the MBAM scan log and a snip of the original error.

 

 

MBAM Scan Log 5-4-14.xml

[Velvetcoat]

Forgot to add mbamservice.exe now shows 0.5% CPU usage so this version does seem to have cured the excessive CPU usage I had before with 2.0.0.1000

[daledoc1]

@Velvetcoat:

 

<just a thought, until AdvancedSetup returns>

 

Is your HD encrypted, by any chance?

(BitLocker, TrueCrypt, SecureDoc, etc)

 

AFAIK, ARK is not supported on encrypted drives.

Users trying to load ARK on such drives are getting error messages and the process will not run.

 

<just a thought, until AdvancedSetup returns>

 

daledoc1

 

P.S. We'll need to wait for AdvancedSetup, but I think he might need the log as a .txt file, not .xml? (I could be wrong about that.)

[Velvetcoat]

That's it! My HDD is Bitlocker encrypted.

[daledoc1]

Yep.
ARK is not supported on encrypted drives at this time.
The technicalities are over my head, but I think I understand why at a basic, home-user kind of level.
 
So, if you disable ARK from the settings, everything ought to work OK.

It might not hurt to reboot after doing so, to be sure the driver unloads.

 

I don't believe there is any other workaround at this time.

But AdvancedSetup and/or exile360 will likely have additional information when they return.

 

Cheers,

 

daledoc1

 

P.S. I will be in the same boat when I upgrade both of my encrypted laptops to 2.00.